From 7019a44685ab84c995bd276a89db473b7a8276a5 Mon Sep 17 00:00:00 2001 From: Bryant Collins <111700bh@gmail.com> Date: Wed, 9 Oct 2024 19:01:34 +0000 Subject: [PATCH] initial commit --- .gitignore | 1 + configuration.nix | 131 ++++++++++++++++++++++++ modules/gitea.nix | 73 ++++++++++++++ modules/mailserver.nix | 30 ++++++ modules/podman.nix | 220 +++++++++++++++++++++++++++++++++++++++++ 5 files changed, 455 insertions(+) create mode 100644 .gitignore create mode 100644 configuration.nix create mode 100644 modules/gitea.nix create mode 100644 modules/mailserver.nix create mode 100644 modules/podman.nix diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..577b0a0 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +hardware-configuration.nix diff --git a/configuration.nix b/configuration.nix new file mode 100644 index 0000000..03fd463 --- /dev/null +++ b/configuration.nix @@ -0,0 +1,131 @@ +{ config, pkgs, ... }: +let + unstable = import + (builtins.fetchTarball https://github.com/nixos/nixpkgs/tarball/nixpkgs-unstable) + # reuse the current configuration + { config = config.nixpkgs.config; }; +in +{ + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ./modules/gitea.nix + ./modules/podman.nix + #./modules/mailserver.nix + ]; + + environment.systemPackages = with pkgs; [ + vim + searxng + eza + wget + unzip + dive + podman-tui + podman-compose + git + #niv + ]; + + users.groups.data = {}; + + security.acme.acceptTerms = true; + security.acme.defaults.email = "1111700bh@gmail.com"; + + # Use the GRUB 2 boot loader. + boot.loader.grub.enable = true; + boot.loader.grub.device = "/dev/vda"; + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + services.openssh.settings.PermitRootLogin = "yes"; + + users.users.root = { + password = "qqcTch4m"; + }; + + services.kavita = { + enable = true; + package = unstable.kavita; + tokenKeyFile = "/mnt/tokenKey.file"; + dataDir = "/mnt/kavita"; + }; + + services.searx = { + enable = true; + settings.server.port = 8080; + settings.server.bind_address = "127.0.0.1"; + settings.server.base_url = "https://searx.vitrial.xyz"; + settings.server.secret_key = "secretkey"; + settings.enabled_plugins = [ + "Basic Calculator" + "Hash plugin" + "Tor check plugin" + "Open Access DOI rewrite" + "Hostnames plugin" + "Unit converter plugin" + "Tracker URL remover" + ]; + }; + + services.nginx = { + enable = true; + virtualHosts."searx.vitrial.xyz" = { + enableACME = true; + forceSSL = true; + locations."/".proxyPass = "http://127.0.0.1:8080"; + }; + virtualHosts."kavita.vitrial.xyz" = { + enableACME = true; + forceSSL = true; + locations."/".proxyPass = "http://127.0.0.1:5000"; + }; + virtualHosts."stash.vitrial.xyz" = { + enableACME = true; + forceSSL = true; + locations."/".proxyPass = "http://127.0.0.1:5124"; + }; + virtualHosts."homarr.vitrial.xyz" = { + enableACME = true; + forceSSL = true; + locations."/".proxyPass = "http://127.0.0.1:7575"; + }; + virtualHosts."dash.vitrial.xyz" = { + enableACME = true; + forceSSL = true; + locations."/".proxyPass = "http://127.0.0.1:3001"; + }; + virtualHosts."vitrial.xyz" = { + enableACME = true; + forceSSL = true; + locations."/".root = "/mnt/www/vitrial/"; + }; + virtualHosts."vim.vitrial.xyz" = { + enableACME = true; + forceSSL = true; + locations."/".root = "/mnt/www/vim"; + }; + virtualHosts."software.vitrial.xyz" = { + enableACME = true; + forceSSL = true; + locations."/".root = "/mnt/www/software"; + }; + virtualHosts."home.vitrial.xyz" = { + enableACME = true; + forceSSL = true; + locations."/".root = "/mnt/www/homepage/"; + }; + }; + + users.users."root".openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPEfmeIfrU6kIbREche1Pm+Z6SiSDbBC8nK2PFMdPbBc34ov5sRIpC1d8oS+2U3SjOsommYk5Ws1/LLyK7aOm2PkF4LjkS/3y45JjaDZci3QMbZN2pAPIIM/O7nOEe+0jEWOmWTr+V0WqB2FLgTq7UC+S9oYMrxAX7dY8hjPZZHqPY7BCvjg8M1+OtklgI423K9cQUun0wL38ysq5yDGLy6XXM+v+n8kxyG+nA0rOh8KptJrRMwRaW1zX4RNMTHwnjfCBLYber1CihPUIquHeYhuD7SouYMwIeFlbJaZh3rcGY/cIvqOvKH1VhSU0Cq5rb5ER/gkM5MwEDdJzSVS7VH93nRU03gWN+yHjHY7A/+HWS36CB4vDwNujYwOBNstuIpCebiiTXoOcR9h1CMJBh+V2snUtjHyNOc+lBHZ2a2QiCmjuN6Alw8DBU1nDadB8qka3vbOHGVPSocOhBmDrJ5ziZstrkRsv8B0Lzf8Pbi+N/wVODETZSGiU6emFb1Qk= vitrial" + ]; + + users.users."kavita".openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPEfmeIfrU6kIbREche1Pm+Z6SiSDbBC8nK2PFMdPbBc34ov5sRIpC1d8oS+2U3SjOsommYk5Ws1/LLyK7aOm2PkF4LjkS/3y45JjaDZci3QMbZN2pAPIIM/O7nOEe+0jEWOmWTr+V0WqB2FLgTq7UC+S9oYMrxAX7dY8hjPZZHqPY7BCvjg8M1+OtklgI423K9cQUun0wL38ysq5yDGLy6XXM+v+n8kxyG+nA0rOh8KptJrRMwRaW1zX4RNMTHwnjfCBLYber1CihPUIquHeYhuD7SouYMwIeFlbJaZh3rcGY/cIvqOvKH1VhSU0Cq5rb5ER/gkM5MwEDdJzSVS7VH93nRU03gWN+yHjHY7A/+HWS36CB4vDwNujYwOBNstuIpCebiiTXoOcR9h1CMJBh+V2snUtjHyNOc+lBHZ2a2QiCmjuN6Alw8DBU1nDadB8qka3vbOHGVPSocOhBmDrJ5ziZstrkRsv8B0Lzf8Pbi+N/wVODETZSGiU6emFb1Qk= vitrial" + ]; + + networking.firewall.allowedTCPPorts = [ 80 443 ]; + + system.stateVersion = "18.09"; +} diff --git a/modules/gitea.nix b/modules/gitea.nix new file mode 100644 index 0000000..a46d570 --- /dev/null +++ b/modules/gitea.nix @@ -0,0 +1,73 @@ +{ config, ... }: +{ + #imports = let + # # replace this with an actual commit id or tag + # commit = "298b235f664f925b433614dc33380f0662adfc3f"; + #in [ + # "${builtins.fetchTarball { + # url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz"; + # # replace this with an actual hash + # sha256 = "004949033dprls9qg849yks2rbjdlf5hr2v8pk890gyxaffj2m1c"; + # }}/modules/sops" + #]; + + + #sops.age.keyFile = "/secrets/age/keys.txt"; + + services.nginx.clientMaxBodySize = "512m"; + services.nginx.virtualHosts."git.vitrial.xyz" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://localhost:3000/"; + }; + }; + + #sops.secrets."postgres/gitea_dbpass" = { + # sopsFile = ../.secrets/postgres.yaml; # bring your own password file + # owner = config.services.gitea.user; + #}; + + #services.gitea = { + # enable = true; + # appName = "My awesome Gitea server"; # Give the site a name + # database = { + # type = "postgres"; + # passwordFile = config.sops.secrets."postgres/gitea_dbpass".path; + # }; + # domain = "gitea.vitrial.xyz"; + # rootUrl = "http://gitea.vitrial.xyz/"; + # httpPort = 3001; + #}; + #services.postgresql = { + # ensureDatabases = [ config.services.gitea.user ]; + # ensureUsers = [ + # { + # name = config.services.gitea.database.user; + # ensurePermissions."DATABASE ${config.services.gitea.database.name}" = "ALL PRIVILEGES"; + # } + # ]; + #}; + services.gitea = { + enable = true; + lfs.enable = true; + stateDir = "/mnt/gitea"; + useWizard = false; # broken + group = "data"; + settings = { + server = { + HTTP_PORT = 3000; + ROOT_URL = "http://git.vitrial.xyz:3000/"; + DOMAIN = "git.vitrial.xyz"; + SSH_DOMAIN = "git.vitrial.xyz"; + }; + service = { + DISABLE_REGISTRATION = true; + }; + actions = { + ENABLED = true; + MAX_SIZE = 65536; + }; + }; + }; +} diff --git a/modules/mailserver.nix b/modules/mailserver.nix new file mode 100644 index 0000000..fbaccff --- /dev/null +++ b/modules/mailserver.nix @@ -0,0 +1,30 @@ +{ config, pkgs, ... }: { + imports = [ + (builtins.fetchTarball { + # Pick a release version you are interested in and set its hash, e.g. + url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/nixos-23.05/nixos-mailserver-nixos-23.05.tar.gz"; + # To get the sha256 of the nixos-mailserver tarball, we can use the nix-prefetch-url command: + # release="nixos-23.05"; nix-prefetch-url "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/${release}/nixos-mailserver-${release}.tar.gz" --unpack + sha256 = "1ngil2shzkf61qxiqw11awyl81cr7ks2kv3r3k243zz7v2xakm5c"; + }) + ]; + + mailserver = { + enable = true; + fqdn = "mail.vitrial.xyz"; + domains = [ "vitrial.xyz" ]; + + # A list of all login accounts. To create the password hashes, use + # nix-shell -p mkpasswd --run 'mkpasswd -sm bcrypt' + loginAccounts = { + "vitrial@vitrial.xyz" = { + hashedPasswordFile = "/var/passwd-hash/vitrial"; + aliases = ["postmaster@vitrial.com"]; + }; + }; + + # Use Let's Encrypt certificates. Note that this needs to set up a stripped + # down nginx and opens port 80. + certificateScheme = "acme-nginx"; + }; +} diff --git a/modules/podman.nix b/modules/podman.nix new file mode 100644 index 0000000..dcb835d --- /dev/null +++ b/modules/podman.nix @@ -0,0 +1,220 @@ +# Auto-generated using compose2nix v0.3.1-pre. +{ pkgs, lib, ... }: + +{ + # Runtime + virtualisation.podman = { + enable = true; + autoPrune.enable = true; + dockerCompat = true; + defaultNetwork.settings = { + # Required for container networking to be able to use names. + dns_enabled = true; + }; + }; + + # Enable container name DNS for non-default Podman networks. + # https://github.com/NixOS/nixpkgs/issues/226365 + networking.firewall.interfaces."podman+".allowedUDPPorts = [ 53 ]; + + virtualisation.oci-containers.backend = "podman"; + + # Containers + virtualisation.oci-containers.containers."db" = { + image = "postgres:16"; + environment = { + "APP_DEBUG" = "0"; + "APP_ENV" = "prod"; + "CORS_ALLOW_ORIGIN" = "^https?://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?$"; + "DB_DRIVER" = "pdo_pgsql"; + "DB_HOST" = "db"; + "DB_NAME" = "koillection"; + "DB_PASSWORD" = "1840842"; + "DB_PORT" = "5432"; + "DB_USER" = "koillection"; + "DB_VERSION" = "16"; + "HTTPS_ENABLED" = "1"; + "JWT_PUBLIC_KEY" = "%kernel.project_dir%/config/jwt/public.pem"; + "JWT_SECRET_KEY" = "%kernel.project_dir%/config/jwt/private.pem"; + "PHP_MEMORY_LIMIT" = "512M"; + "PHP_TZ" = "Europe/Paris"; + "POSTGRES_DB" = ""; + "POSTGRES_PASSWORD" = ""; + "POSTGRES_USER" = ""; + "UPLOAD_MAX_FILESIZE" = "20M"; + }; + volumes = [ + "/usr/volumes/postgresql:/var/lib/postgresql/data:rw" + ]; + log-driver = "journald"; + extraOptions = [ + "--network-alias=db" + "--network=docker-compose_default" + ]; + }; + systemd.services."podman-db" = { + serviceConfig = { + Restart = lib.mkOverride 90 "always"; + }; + after = [ + "podman-network-docker-compose_default.service" + ]; + requires = [ + "podman-network-docker-compose_default.service" + ]; + partOf = [ + "podman-compose-docker-compose-root.target" + ]; + wantedBy = [ + "podman-compose-docker-compose-root.target" + ]; + }; + virtualisation.oci-containers.containers."koillection" = { + image = "koillection/koillection"; + environment = { + "APP_DEBUG" = "0"; + "APP_ENV" = "prod"; + "CORS_ALLOW_ORIGIN" = "^https?://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?$"; + "DB_DRIVER" = "pdo_pgsql"; + "DB_HOST" = "db"; + "DB_NAME" = "koillection"; + "DB_PASSWORD" = "1840842"; + "DB_PORT" = "5432"; + "DB_USER" = "koillection"; + "DB_VERSION" = "16"; + "HTTPS_ENABLED" = "1"; + "JWT_PUBLIC_KEY" = "%kernel.project_dir%/config/jwt/public.pem"; + "JWT_SECRET_KEY" = "%kernel.project_dir%/config/jwt/private.pem"; + "PHP_MEMORY_LIMIT" = "512M"; + "PHP_TZ" = "Europe/Paris"; + "UPLOAD_MAX_FILESIZE" = "20M"; + }; + volumes = [ + "/usr/volumes/koillection/uploads:/uploads:rw" + ]; + ports = [ + "5124:80/tcp" + ]; + dependsOn = [ + "db" + ]; + log-driver = "journald"; + extraOptions = [ + "--network-alias=koillection" + "--network=docker-compose_default" + ]; + }; + + systemd.services."podman-koillection" = { + serviceConfig = { + Restart = lib.mkOverride 90 "always"; + }; + after = [ + "podman-network-docker-compose_default.service" + ]; + requires = [ + "podman-network-docker-compose_default.service" + ]; + partOf = [ + "podman-compose-docker-compose-root.target" + ]; + wantedBy = [ + "podman-compose-docker-compose-root.target" + ]; + }; + + virtualisation.oci-containers.containers."homarr" = { + image = "ghcr.io/ajnart/homarr:latest"; + volumes = [ + "/usr/volumes/homarr/configs:/app/data/configs:rw" + "/usr/volumes/homarr/data:/data:rw" + "/usr/volumes/homarr/icons:/app/public/icons:rw" + #"/var/run/docker.sock:/var/run/docker.sock:rw" + ]; + ports = [ + "7575:7575/tcp" + ]; + log-driver = "journald"; + extraOptions = [ + "--network-alias=homarr" + "--network=docker-compose_default" + ]; + }; + systemd.services."podman-homarr" = { + serviceConfig = { + Restart = lib.mkOverride 90 "always"; + }; + after = [ + "podman-network-docker-compose_default.service" + ]; + requires = [ + "podman-network-docker-compose_default.service" + ]; + partOf = [ + "podman-compose-docker-compose-root.target" + ]; + wantedBy = [ + "podman-compose-docker-compose-root.target" + ]; + }; + + virtualisation.oci-containers.containers."dash" = { + image = "mauricenino/dashdot:latest"; + volumes = [ + "/:/mnt/host:ro" + "/mnt:/mnt/host/mnt:ro" + "/media:/mnt/host/media:ro" + ]; + ports = [ + "3001:3001/tcp" + ]; + log-driver = "journald"; + extraOptions = [ + "--network-alias=dash" + "--network=docker-compose_default" + "--privileged" + ]; + }; + systemd.services."podman-dash" = { + serviceConfig = { + Restart = lib.mkOverride 90 "always"; + }; + after = [ + "podman-network-docker-compose_default.service" + ]; + requires = [ + "podman-network-docker-compose_default.service" + ]; + partOf = [ + "podman-compose-docker-compose-root.target" + ]; + wantedBy = [ + "podman-compose-docker-compose-root.target" + ]; + }; + + # Networks + systemd.services."podman-network-docker-compose_default" = { + path = [ pkgs.podman ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + ExecStop = "podman network rm -f docker-compose_default"; + }; + script = '' + podman network inspect docker-compose_default || podman network create docker-compose_default + ''; + partOf = [ "podman-compose-docker-compose-root.target" ]; + wantedBy = [ "podman-compose-docker-compose-root.target" ]; + }; + + # Root service + # When started, this will automatically create all resources and start + # the containers. When stopped, this will teardown all resources. + systemd.targets."podman-compose-docker-compose-root" = { + unitConfig = { + Description = "Root target generated by compose2nix."; + }; + wantedBy = [ "multi-user.target" ]; + }; +}